Signed URLs are now available for Vercel Blob

You can now generate time-bound signed URLs for Vercel Blob. A signed URL is a scoped URL with an expiry that allows you to upload, download, inspect, or delete a specific object without giving access to your entire Blob store.

Each URL is scoped to a single operation (put, get, head, or delete), a single pathname, and an expiry you choose, up to 7 days. The signature covers the operation and constraints, so a URL signed for a GET can't be reused as a PUT.

1
import { issueSignedToken, presignUrl } from '@vercel/blob';
2

3
const token = await issueSignedToken({
4
  operations: ['get'],
5
});
6

7
const { presignedUrl } = await presignUrl(token, {
8
  pathname: 'invoices/2026-q1.pdf',
9
  operation: 'get',
10
  validUntil: Date.now() + 5 * 60 * 1000, // 5 minutes
11
});
12

13
// On client
14
<img src={presignedUrl} />

Link to headingDirect uploads from the browser

Upload URLs (put) support multipart, so the browser can stream large files straight to Blob storage without round-tripping through your server.

1
import { presignUrl } from '@vercel/blob';
2

3
const { presignedUrl } = await presignUrl(token, {
4
  pathname: 'user-uploads/avatar.png',
5
  operation: 'put',
6
  validUntil: Date.now() + 15 * 60 * 1000,
7
});
8

9
// On client
10
await fetch(presignedUrl, { method: 'PUT', body: file })

Link to headingConditional deletes

Delete URLs accept an ifMatch option so the delete only applies if the object hasn't been overwritten since you signed the URL:

1
import { presignUrl } from '@vercel/blob';
2

3
const { presignedUrl } = await presignUrl(token, {
4
  pathname: 'tmp/session.json',
5
  operation: 'delete',
6
  validUntil: Date.now() + 60 * 1000,
7
  ifMatch: '"a1b2c3"', // ETag of the version you intend to remove
8
});
9

10
// On client
11
await fetch(presignedUrl, { method: 'DELETE' })

Signed URLs work alongside OIDC. Your server authenticates to Blob via OIDC, generates a signed token, and produces narrowly scoped, time-bound URLs for the browser, so your long-lived BLOB_READ_WRITE_TOKEN never leaves the server.

Update @vercel/blob to 2.4.0 and read the documentation to get started.